CVE-2026-6022
Uncontrolled Resource Consumption in Telerik RadAsyncUpload Causes Disk Exhaustion
Publication date: 2026-04-22
Last updated on: 2026-05-05
Assigner: Progress Software Corporation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| progress | telerik_ui_for_asp.net_ajax | to 2026.1.421 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-400 | The product does not properly control the allocation and maintenance of a limited resource. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-6022 is an uncontrolled resource consumption vulnerability in Progress® Telerik® UI for AJAX versions prior to 2026.1.421. Specifically, the RadAsyncUpload component does not properly enforce the configured maximum file upload size cumulatively during chunk reassembly. This means that attackers can upload files that exceed the intended size limits by sending multiple chunks, which are then combined without proper size checks.
As a result, this flaw can lead to excessive disk space usage on the server.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing attackers to consume excessive disk space on your server through oversized file uploads. Because the maximum upload size is not properly enforced cumulatively, attackers can bypass size restrictions and cause disk space exhaustion.
Such resource exhaustion can lead to denial of service conditions, potentially disrupting normal operations and affecting availability.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in Progress® Telerik® UI for AJAX prior to 2026.1.421 allows uncontrolled resource consumption through file uploads exceeding the configured maximum size, leading to disk space exhaustion.
While the CVE description and available resources do not explicitly mention compliance with standards such as GDPR or HIPAA, uncontrolled resource consumption vulnerabilities can indirectly impact compliance by causing denial of service or system unavailability, which may affect the integrity and availability requirements of these regulations.
However, there is no direct information provided about how this vulnerability specifically affects compliance with GDPR, HIPAA, or other common standards.